Designing a ‘ universal ’ Web application server

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that the copies are not made or distributed for profit or commercial advantage, that the copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than SAICSIT or the ACM must be honoured. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, or to redistribute to lists, requires prior specific permission and/or a fee. Modern Web server systems typically consist of a single Web server instance capable of utilising various backend technologies. For security reasons this Web server instance is run as the unprivileged user, the user 'nobody'. This has the implication of having users make their Web components world-accessible so that such an unprivileged Web server instance may access them. World accessible files or directories are open to many threats including modification and removal by any system user, authorised or unauthorised. The X-Switch system attempts to provide a solution to this problem by allowing Web components to be run with an identical set of privileges as the component owner, an essential feature for maintaining secure multiuser server environments. The X-Switch system is a generalisation of existing solutions but attempts to provide a higher level of performance and scalability while maintaining the benefits of being independent of the implementation language used. The X-Switch system's experimental results demonstrated that a Web server that utilises run-time context switching can achieve a high level of performance. Furthermore it was shown that an X-Switch compatible engine can be developed to provide functionality matching that of existing Web application servers but with the added benefit of multiuser support. Finally the X-Switch system showed that it is feasible to completely separate issues of performance from the Web component code thus ensuring that the developer is free from the task of modifying his/her code to make it compatible with the deployment platform.